Drivers in operating systems run in either user-mode or kernel-mode. User-mode drivers run in the non-privileged processor mode in which other application code, including protected subsystem code, executes. User-mode drivers cannot gain access to system data or hardware except by calling an application programming interface (API) which, in turn, calls system services. Kernel-mode drivers run as part of the operating system's executive, the underlying operating system component that supports one or more protected subsystems.
User-mode and kernel-mode drivers have different structures, different entry points, and different system interfaces. Whether a device requires a user-mode or kernel-mode driver depends on the type of device and the support already provided for it in the operating system. Most device drivers run in kernel-mode. Kernel-mode drivers can perform certain protected operations and can access system structures that user-mode drivers cannot access. Moreover, kernel-mode drivers often offer lower-latency services. However, kernel-mode drivers can cause instability and system crashes if not implemented properly, as well as introduce security vulnerabilities.